virtio: fix segfault on Tx desc flags setup

After the do-while loop, idx could be VQ_RING_DESC_CHAIN_END (32768)
when it's the last vring desc buf we can get. Therefore, following
expresssion could lead to a segfault error, as it tries to access
beyond the desc memory boundary.

    start_dp[idx].flags &= ~VRING_DESC_F_NEXT;

This bug could be reproduced easily with "set fwd txonly" in the
guest PMD, where the dequeue on host is slower than the guest Tx,
that running out of free desc buf is pretty easy.

The fix is straightforward and easy, just remove it, as we have
already set desc flags properly inside the do-while loop.

Fixes: dd856dfcb9e ("virtio: use any layout on Tx")

[Yuanhan Liu: commit log reword]
Signed-off-by: Jianfeng Tan <jianfeng.tan@intel.com>
Acked-by: Huawei Xie <huawei.xie@intel.com>
Acked-by: Yuanhan Liu <yuanhan.liu@linux.intel.com>

diff --git a/drivers/net/virtio/virtio_rxtx.c b/drivers/net/virtio/virtio_rxtx.c
index 2dafebd..f326222 100644 (file)
--- a/drivers/net/virtio/virtio_rxtx.c
+++ b/drivers/net/virtio/virtio_rxtx.c
@@ -271,8 +271,6 @@ virtqueue_enqueue_xmit(struct virtqueue *txvq, struct rte_mbuf *cookie,
                idx = start_dp[idx].next;
        } while ((cookie = cookie->next) != NULL);
 
-       start_dp[idx].flags &= ~VRING_DESC_F_NEXT;
-
        if (use_indirect)
                idx = txvq->vq_ring.desc[head_idx].next;